What does Modbus Exception Code 01 (Illegal Function) mean?

Modbus Exception Code 01 (Illegal Function) is returned by a slave or server when the function code received in the query is not an allowable action for the device. This occurs when the master requests an operation that the device firmware has not implemented, such as attempting a write operation on a read-only instrument, polling coils on a register-only device, or using an unsupported function code like FC 16 (Write Multiple Registers) when only FC 06 (Write Single Register) is supported.

Why do read-only sensors return Exception 01 on write attempts?

Many industrial instruments, including temperature transmitters, energy meters, and flow meters, only support read function codes (FC 03 Read Holding Registers or FC 04 Read Input Registers). If a SCADA system, PLC, or test utility mistakenly issues a write command (FC 05 Write Single Coil, FC 06 Write Single Register, or FC 16 Write Multiple Registers), the device firmware rejects the command with Exception Code 01 because writing is fundamentally disallowed.

What is the difference between Function Code 06 and Function Code 16?

Function Code 06 (0x06) writes a single 16-bit register, while Function Code 16 (0x10) writes a block of multiple consecutive 16-bit registers. Many legacy microcontrollers, smart relays, and basic sensors only implement FC 06. If a modern master software defaults to FC 16 even when writing a single register, the device returns Exception 01. Check your master's communication driver settings to force FC 06 for single register writes.

How does decimal vs hexadecimal notation cause Exception 01?

Function Code 16 is decimal 16, which is hexadecimal 0x10. If an engineer enters 16 in a hex field in their Modbus master software, the master transmits 0x16 (which corresponds to Modbus Function Code 22, Mask Write Register). Since very few devices implement FC 22, the slave rejects the frame with Exception Code 01. Always verify whether your master software expects decimal or hexadecimal input for function codes.

How does an Exception 01 response look on the wire in hex?

When a slave rejects a query with Exception 01, it responds by echoing the Slave ID, setting the most significant bit (MSB, bit 7, 0x80) of the Function Code, followed by the exception byte 0x01. For example, if the master sends FC 06 (Write Single Register) to Slave 1, the slave responds with: [01] [86] [01] [CRC-L] [CRC-H]. If the master sends FC 16 (0x10), the slave responds with: [01] [90] [01] [CRC-L] [CRC-H].

How can I simulate and debug Exception 01 using ModbusSimulator?

ModbusSimulator allows you to emulate both masters and slaves with configurable function code support tables. You can disable specific function codes (like FC 16 or FC 05) on a virtual slave to test how your PLC or SCADA handles Exception 01 error routines, inspect raw hexadecimal RX/TX frames in real time, and verify that fallback write commands operate as expected before connecting to physical hardware.

Modbus Exception Code 01 (Illegal Function): Causes & Fixes (2026 Guide)

What is Modbus Exception Code 01?

According to the official Modbus Application Protocol Specification V1.1b3, Exception Code 01 (Illegal Function) is defined as follows:

"The function code received in the query is not an allowable action for the server (or slave). This may be because the function code is only applicable to certain kinds of devices, and is not implemented in the server selected. It could also indicate that the server is in the wrong state to process a request of this type."

In simpler terms: your master transmitted a function code that the slave's firmware does not recognize, does not support, or currently has locked out. Unlike Modbus Exception Code 02 (Illegal Data Address) where the function code is valid but the register offset is out of bounds, Exception 01 means the slave cannot even begin evaluating the register address because the command itself is disallowed.

How Exception Code 01 Appears on the Wire

When a slave receives an unsupported function code, it constructs an Exception Response Frame following standard Modbus protocol rules:

Slave Address Byte: Echoes the targeted Unit ID / Slave Address (e.g., 0x01).
Exception Function Code Byte: The original function code transmitted by the master, with its most significant bit (MSB, bit 7, 0x80) set to 1.
- If Master sent 0x01 (Read Coils) → Slave returns 0x81
- If Master sent 0x05 (Write Single Coil) → Slave returns 0x85
- If Master sent 0x06 (Write Single Register) → Slave returns 0x86
- If Master sent 0x10 (Write Multiple Registers, decimal 16) → Slave returns 0x90
Exception Code Byte: The literal byte value 0x01, identifying Illegal Function.
Error Check: Standard 16-bit CRC (for Modbus RTU) or MBAP length header (for Modbus TCP).

Example Wire Capture (Modbus RTU over RS-485):
Master Request: 01 05 00 00 FF 00 8C 3A (Write ON to Coil 0)
Slave Response: 01 85 01 83 60 (Slave 1, Exception 0x85, Code 0x01, CRC)
Interpretation: Slave 01 does not support discrete coils or Function Code 05.

Top 5 Root Causes of Exception Code 01 in Industrial Systems

1. Attempting Write Operations on Read-Only Instrumentation

In process plants and power distribution systems, many sensors—such as digital power meters, BTU thermal meters, ultrasonic flow transmitters, and thermocouple transducers—are manufactured with read-only firmware. These devices map all process variables to Input Registers (30001–39999, Function Code 04) or read-only Holding Registers (40001–49999, Function Code 03).

If your SCADA software (such as Ignition, Wonderware, or FactoryTalk) or PLC communications block attempts to write a configuration parameter, reset an accumulator, or clear a fault counter using Function Code 06 or Function Code 16, the device firmware immediately rejects the frame with Exception 01.

Fix: Consult the vendor's register map. If the parameter is designated as read-only, remove write tags in your host software. If the parameter is writable, check if a physical DIP switch, hardware jumper, or front-panel security PIN must be set to "Write Enable" mode.

2. Function Code 06 (Write Single) vs Function Code 16 (Write Multiple) Incompatibility

This is one of the most common surprises when upgrading SCADA software or PLC communication drivers. The Modbus standard specifies two distinct function codes for writing holding registers:

Function Code 06 (0x06): Write Single Holding Register. Contains exactly one 16-bit register address and one 16-bit value.
Function Code 16 (0x10, decimal 16): Write Multiple Holding Registers. Contains a starting register address, quantity of registers, byte count, and register values.

Many compact PLCs, smart actuators, VFD drives, and embedded microcontrollers only implement Function Code 06 to conserve flash memory. However, many modern SCADA engines default to using Function Code 16 for all write operations—even when writing a single 16-bit integer! When the slave receives FC 16 (0x10), it does not execute the write and returns Exception 01.

Fix: In your Modbus master driver configuration (in Kepware, Modbus Poll, Node-RED, or ModbusSimulator), locate the setting labeled "Write Single Registers using Function 06" or "Force FC 06 for Single Register Writes" and enable it.

3. Hexadecimal vs. Decimal Notation Mix-ups

Modbus function codes are conventionally expressed in decimal, but transmitted over the wire in hexadecimal bytes. When configuring custom Modbus master blocks in PLCs or test software:

Function Code 16 (Write Multiple Registers) is decimal 16, which equals hexadecimal 0x10.
If an engineer enters "16" into a field expecting hexadecimal input, the master sends 0x16. In the Modbus specification, 0x16 corresponds to Function Code 22 (Mask Write Register).
Because almost no standard field devices implement Function Code 22, the slave rejects the message with Exception 01.

Fix: Double-check the base (DEC vs HEX) of your driver configuration dialog. Ensure Write Multiple Registers transmits 0x10, not 0x16.

4. Mismatched Table Types: Coils vs Registers

Modbus organizes data into four distinct memory tables:

Table Type	Data Size	Access	Standard Function Codes
Discrete Inputs (1x)	1 bit	Read-Only	FC 02 (0x02)
Coils (0x)	1 bit	Read/Write	FC 01 (0x01), FC 05 (0x05), FC 15 (0x0F)
Input Registers (3x)	16 bits	Read-Only	FC 04 (0x04)
Holding Registers (4x)	16 bits	Read/Write	FC 03 (0x03), FC 06 (0x06), FC 16 (0x10)

If your polling application issues Function Code 01 (Read Coils) to a device that has no discrete bit table and only exposes 16-bit analog registers, the device will respond with Exception 01. Always verify that your query function code matches the device's actual physical memory architecture.

5. Modbus Gateway / Protocol Converter Protocol Mismatch

When routing Modbus TCP queries through an Ethernet-to-Serial gateway (such as a Moxa MB3170 or Advantech ADAM-4572), the gateway repackages TCP frames into RTU frames. If the master sends a specialized or vendor-specific function code (e.g., FC 20 Read File Record, FC 43 Read Device Identification) that the gateway's internal firmware parser does not support in its translation table, the gateway itself may intercept the query and return Exception 01 without ever forwarding the packet to the downstream serial bus.

Fix: Update the gateway firmware to the latest version and configure the serial operating mode to "Transparent / Tunneling Mode" rather than "Smart Gateway / Modbus Concentrator Mode".

Step-by-Step Diagnostic Workflow for Exception Code 01

Follow this systematic 4-step troubleshooting procedure to isolate and eliminate Exception 01 errors:

Capture Raw Frames: Connect an RS-485 USB adapter with a terminal monitor, or capture network traffic using Wireshark for Modbus TCP. Filter by modbus.func_code >= 128 to locate exception frames.
Verify Function Code Byte: Inspect the byte directly following the Slave ID. Subtract 0x80 from the exception byte to determine which function code the master sent. (e.g., 0x86 - 0x80 = 0x06).
Check Device Manual Function Code Table: Look up the supported function codes section in the vendor documentation. Verify whether the device explicitly lists that function code as supported.
Test Alternative Function Codes: If FC 16 fails, test FC 06. If FC 04 fails, test FC 03. If write operations fail, check hardware write-protect switches on the instrument.

Simulating and Testing Exception 01 with ModbusSimulator

Before deploying new SCADA polling routines or PLC logic to live manufacturing plants, you can simulate exact exception conditions using ModbusSimulator on Windows:

Emulate Restrictive Slaves: Configure virtual slave devices to support only FC 03 and FC 04, simulating read-only field transmitters.
Verify Master Error Handling: Confirm that your SCADA alarms, PLC retry timers, and communication failover scripts handle Exception 01 cleanly without freezing communication tasks.
Test Function Code 06 vs 16: Toggle support for multi-register writes to verify whether your master client falls back gracefully.
Real-Time Hex Logging: Monitor incoming wire requests and outgoing exception responses in the integrated packet inspector without needing external protocol analyzers.

Summary Comparison: Exception Code 01 vs Other Common Exceptions

Exception Code	Name	Meaning	Primary Fix
01 (0x01)	Illegal Function	Function code not implemented or disallowed by device	Switch to supported FC (FC 06 vs 16, FC 03 vs 04) or disable write tags
02 (0x02)	Illegal Data Address	Register address is outside memory boundaries	Adjust 0-based vs 1-based offset or reduce read quantity
03 (0x03)	Illegal Data Value	Data field value or block quantity exceeds allowable limit	Check quantity limits (max 125 registers for FC 03) or write value ranges
04 (0x04)	Slave Device Failure	Unrecoverable hardware or memory fault inside the slave	Power cycle instrument, check sensor wiring, or inspect device diagnostics

Modbus Exception Code 01 (Illegal Function): Causes & Fixes